Pattern Mining and Anomaly Detection based on Power System Synchrophasor Measurements

Real-time monitoring of power system dynamics using phasor measurement units (PMUs) data improves situational awareness and system reliability, and helps prevent electric grid blackouts due to early anomaly detection. The study presented in this paper is based on real PMU measurements of the U.S. Western Interconnection system. Given the nonlinear and non-stationary PMU data, we developed a robust anomaly detection framework that uses wavelet-based multi-resolution analysis with moving-window-based outlier detection and anomaly scoring to identify potential PMU events. Candidate events were evaluated via spatiotemporal correlation analysis and classified for a better understanding of event types, resulting in successful anomaly detection and classification of the recorded events

Distribution System Disturbance Analysis and Outage Management Using Hybrid Data-Driven and Physics-Based Approaches

Securing cyber-power distribution systems (DS) against malicious events is critical with the integration of distributed energy resources (DERs), supporting automation and increasing vulnerabilities. Situational awareness utilizing power data (e.g., data from distribution phasor measurement units (D-PMUs)) and cyber data (e.g., network packets data) is the main focus of this dissertation by means of which, an opportunity for real-time monitoring and decision-making is provided. To further improve the DS’s reliable and resilient operation, in this Ph.D. work, the aim has been put towards the development of an automated tool consisting of multiple modules to precisely investigate any type of data anomalies, followed by root cause finding. For this purpose, a data aggregation scheme is developed to synchronize the resolution and time stamp of multiple metering sources throughout the DS, using an enhancement of the conventional Kalman Filter, named Ensemble Extended Kalman Filter (EEKF). EEKF is implemented as an automated module by exploiting the real-time measurements as well as deriving the system physics. Furthermore, this dissertation develops online cyber-physical event detection and classification as well as proposal of the novel Outage Root Cause Analysis (ORCA) system. Different sections of the work have been tested on IEEE and OPAL-RT test systems as well as real-filed measurements from installed actual hardwares

Early Anomaly Detection and Classification with Streaming Synchrophasor Data in Electric Energy Systems

The large-scale streaming data collected from the increasing deployed phasor measurement unit (PMU) devices poses significant difficulties for real-time data-driven analytics in power systems. This dissertation presents a dimensionality-reduction-based monitoring framework to make better use of the streaming PMU data for early anomaly detection and classification in power systems. The first part of this dissertation studies the fundamental dimensionality of large-scale PMU data, and proposes an online application for early anomaly detection using the reduced dimensionality. First, PMU data under both normal and abnormal conditions are analyzed by principal component analysis (PCA), and the results suggest an extremely low underlying dimensionality despite the large number of raw measurements. In comparison with prior work of utilizing multi-channel high-dimensional PMU data for power system anomaly detection, the proposed early anomaly detection algorithm employs the reduced-dimensional data from PCA, and detects the occurrence of an anomaly based on the change of core subspaces of the low-dimensional PMU data. Theoretical justification for the algorithm is provided using linear dynamical system theory. It is demonstrated that the proposed algorithm is capable to detect general power system anomalies at an earlier stage than would be possible by monitoring the raw PMU data. The second part of this dissertation investigates the classification of a special anomaly in power systems, low-frequency oscillation, which may cause severe impacts on power systems while at the same time is difficult to be accurately classified. We present a robust classification framework with online detection and mode estimation of low-frequency oscillations by using synchrophasor data. Based on persistent homology, a cyclicity response function is proposed to detect an oscillation, through the use of the low-dimensional features (pre-PCA features) extracted from PCA. Whenever the cyclicity response exceeds a numerically robust threshold, an oscillation can be detected. After the detection, PCA is applied again to extract the low-dimensional features (post-PCA features) from the multi-channel transient PMU data. It is shown that the post-PCA features preserve the underlying modal information in a more robust way in comparison to raw synchrophasor measurements. Based on the post-PCA features, fast Fourier transform (FFT) and Prony analysis can be subsequently applied to extract modal information of the oscillation. The proposed classification framework offers system operators a data-driven analytical tool for fast detection of low-frequency oscillation and robust mode estimation against high measurement noise

Machine Learning Based Detection of False Data Injection Attacks in Wide Area Monitoring Systems

The Smart Grid (SG) is an upgraded, intelligent, and a more reliable version of the traditional Power Grid due to the integration of information and communication technologies. The operation of the SG requires a dense communication network to link all its components. But such a network renders it prone to cyber attacks jeopardizing the integrity and security of the communicated data between the physical electric grid and the control centers. One of the most prominent components of the SG are Wide Area Monitoring Systems (WAMS). WAMS are a modern platform for grid-wide information, communication, and coordination that play a major role in maintaining the stability of the grid against major disturbances. In this thesis, an anomaly detection framework is proposed to identify False Data Injection (FDI) attacks in WAMS using different Machine Learning (ML) and Deep Learning (DL) techniques, i.e., Deep Autoencoders (DAE), Long-Short Term Memory (LSTM), and One-Class Support Vector Machine (OC-SVM). These algorithms leverage diverse, complex, and high-volume power measurements coming from communications between different components of the grid to detect intelligent FDI attacks. The injected false data is assumed to target several major WAMS monitoring applications, such as Voltage Stability Monitoring (VSM), and Phase Angle Monitoring (PAM). The attack vector is considered to be smartly crafted based on the power system data, so that it can pass the conventional bad data detection schemes and remain stealthy. Due to the lack of realistic attack data, machine learning-based anomaly detection techniques are used to detect FDI attacks. To demonstrate the impact of attacks on the realistic WAMS traffic and to show the effectiveness of the proposed detection framework, a Hardware-In-the-Loop (HIL) co-simulation testbed is developed. The performance of the implemented techniques is compared on the testbed data using different metrics: Accuracy, F1 score, and False Positive Rate (FPR) and False Negative Rate (FNR). The IEEE 9-bus and IEEE 39-bus systems are used as benchmarks to investigate the framework scalability. The experimental results prove the effectiveness of the proposed models in detecting FDI attacks in WAMS

Real-Time Machine Learning Models To Detect Cyber And Physical Anomalies In Power Systems

A Smart Grid is a cyber-physical system (CPS) that tightly integrates computation and networking with physical processes to provide reliable two-way communication between electricity companies and customers. However, the grid availability and integrity are constantly threatened by both physical faults and cyber-attacks which may have a detrimental socio-economic impact. The frequency of the faults and attacks is increasing every year due to the extreme weather events and strong reliance on the open internet architecture that is vulnerable to cyber-attacks. In May 2021, for instance, Colonial Pipeline, one of the largest pipeline operators in the U.S., transports refined gasoline and jet fuel from Texas up the East Coast to New York was forced to shut down after being attacked by ransomware, causing prices to rise at gasoline pumps across the country. Enhancing situational awareness within the grid can alleviate these risks and avoid their adverse consequences. As part of this process, the phasor measurement units (PMU) are among the suitable assets since they collect time-synchronized measurements of grid status (30-120 samples/s), enabling the operators to react rapidly to potential anomalies. However, it is still challenging to process and analyze the open-ended source of PMU data as there are more than 2500 PMU distributed across the U.S. and Canada, where each of which generates more than 1.5 TB/month of streamed data. Further, the offline machine learning algorithms cannot be used in this scenario, as they require loading and scanning the entire dataset before processing. The ultimate objective of this dissertation is to develop early detection of cyber and physical anomalies in a real-time streaming environment setting by mining multi-variate large-scale synchrophasor data. To accomplish this objective, we start by investigating the cyber and physical anomalies, analyzing their impact, and critically reviewing the current detection approaches. Then, multiple machine learning models were designed to identify physical and cyber anomalies; the first one is an artificial neural network-based approach for detecting the False Data Injection (FDI) attack. This attack was specifically selected as it poses a serious risk to the integrity and availability of the grid; Secondly, we extend this approach by developing a Random Forest Regressor-based model which not only detects anomalies, but also identifies their location and duration; Lastly, we develop a real-time hoeffding tree-based model for detecting anomalies in steaming networks, and explicitly handling concept drifts. These models have been tested and the experimental results confirmed their superiority over the state-of-the-art models in terms of detection accuracy, false-positive rate, and processing time, making them potential candidates for strengthening the grid\u27s security

Synchronized measurement data conditioning and real-time applications

Phasor measurement units (PMU), measuring voltage and current phasor with synchronized timestamps, is the fundamental component in wide-area monitoring systems (WAMS) and reveals complex dynamic behaviors of large power systems. The synchronized measurements collected from power grid may degrade due to many factors and impacts of the distorted synchronized measurement data are significant to WAMS. This dissertation focus on developing and improving applications with distorted synchronized measurements from power grid. The contributions of this dissertation are summarized below. In Chapter 2, synchronized frequency measurements of 13 power grids over the world, including both mainland and island systems, are retrieved from Frequency Monitoring Network (FNET/GridEye) and the statistical analysis of the typical power grids are presented. The probability functions of the power grid frequency based on the measurements are calculated and categorized. Developments of generation trip/load shedding and line outage events detection and localization based on high-density PMU measurements are investigated in Chapters 3 and 4 respectively. Four different types of abnormal synchronized measurements are identified from the PMU measurements of a power grid. The impacts of the abnormal synchronized measurements on generation trip/load shedding events detection and localization are evaluated. A line outage localization method based on power flow measurements is proposed to improve the accuracy of line outage events location estimation. A deep learning model is developed to detect abnormal synchronized measurements in Chapter 5. The performance of the model is evaluated with abnormal synchronized measurements from a power grid under normal operation status. Some types of abnormal synchronized measurements in the testing cases are recently observed and reported. An extensive study of hyper-parameters in the model is conducted and evaluation metrics of the model performance are presented. A non-contact synchronized measurements study using electric field strength is investigated in Chapter 6. The theoretical foundation and equation derivations are presented. The calculation process for a single circuit AC transmission line and a double circuit AC transmission line are derived. The derived method is implemented with Matlab and tested in simulation cases

Vulnerability Assessment and Privacy-preserving Computations in Smart Grid

Modern advances in sensor, computing, and communication technologies enable various smart grid applications which highlight the vulnerability that requires novel approaches to the field of cybersecurity. While substantial numbers of technologies have been adopted to protect cyber attacks in smart grid, there lacks a comprehensive review of the implementations, impacts, and solutions of cyber attacks specific to the smart grid.In this dissertation, we are motivated to evaluate the security requirements for the smart grid which include three main properties: confidentiality, integrity, and availability. First, we review the cyber-physical security of the synchrophasor network, which highlights all three aspects of security issues. Taking the synchrophasor network as an example, we give an overview of how to attack a smart grid network. We test three types of attacks and show the impact of each attack consisting of denial-of-service attack, sniffing attack, and false data injection attack.Next, we discuss how to protect against each attack. For protecting availability, we examine possible defense strategies for the associated vulnerabilities.For protecting data integrity, a small-scale prototype of secure synchrophasor network is presented with different cryptosystems. Besides, a deep learning based time-series anomaly detector is proposed to detect injected measurement. Our approach observes both data measurements and network traffic features to jointly learn system states and can detect attacks when state vector estimator fails.For protecting data confidentiality, we propose privacy-preserving algorithms for two important smart grid applications. 1) A distributed privacy-preserving quadratic optimization algorithm to solve Security Constrained Optimal Power Flow (SCOPF) problem. The SCOPF problem is decomposed into small subproblems using the Alternating Direction Method of Multipliers (ADMM) and gradient projection algorithms. 2) We use Paillier cryptosystem to secure the computation of the power system dynamic simulation. The IEEE 3-Machine 9-Bus System is used to implement and demonstrate the proposed scheme. The security and performance analysis of our implementations demonstrate that our algorithms can prevent chosen-ciphertext attacks at a reasonable cost